Blinding ballot copying in Helios:
from Condorcet to IACR
Yvo Desmedt

Pyrros I.P. Chaidos

University College London, UK

August 16, 2011

What do Helios Ballots look like...
I

Suppose: an election for 2 seats with 10candidates. Helios represents a voter’s choiceP
as vi ∈ {0, 1}, i = 0..10 withvi ≤ 2. Theneach vi is encrypted with ElGamal.

What do Helios Ballots look like...
Suppose: an election for 2 seats with 10
candidates. Helios represents a voter’s choice
Pas vi ∈ {0, 1}, i = 0..10 withvi ≤ 2. Theneach vi is encrypted with ElGamal.
I To keep the voter honest Helios forces thevoter to prove that:I(vi = 0) OR (vi = 1) for every i.
PPPI (vi = 0) OR ( vi = 1) OR ( vi = 2)
I

I

Helios uses disjunctive proofs for that, and theFiat-Shamir trick to keep them non-interactive.

... and what will we do with them.
I

We want to copy them.

... and what will we do with them.
I

We want to copy them. Without being obvious.

IBob trusts Alice, especially when it comes topolitics. He decides to vote the same as shedoes.

I

Alice wants to help Bob, but will not reveal hervote.

I

Bob could copy her ballot verbatim (as byCourtier & Smyth), but that’s detectable.

A better approach to copying.
Alice will help Bob make a blinded copy of herballot. When they’re done:
I

Alice’s vote will stay secret.

I

Bob will be confident his ballot is equivalent to
Alice’s vote.

I

Not even Alice will know whether Bob’s
submitted vote is a “copied” vote.

Copying in practice
I

Alice gets the encryption randomness from her browser
before casting her vote.

Bob can blind the ElGamal ciphertext himself but needs
help in creating the proofs. For this we use divertible
proofs.
I Some difficulties we had to overcome:
IDivertible proofs prove the original claim. Here, however, Bob
wants to blind Alice’s ciphertext.
I Applying the Fiat-Shamir trick now (on Bob’s ciphertext) will
give new queries. To solve this, we let Alice and Bob interact.
I There were no divertible proofs for disjunctive proofs before
our work.
IWhy copy?
One of the problems of plurality is the“spoiler effect.” This means, votes tounelectable candidates may imply thatsome unpopular candidate wins.
This was already observed by Condorcet,a French scientist.
I

Copying votes can limit the impact of the spoiler effect,improving fairness for other parties. So, Helios may help
fight the spoiler effect.

IWe realize, that a voting block may imply theircandidates be over-represented. Since Helios ismalleable, this might be negative.

Example election: IACR 2011IThe French seem to know Condorcet’s work well!

Example election: IACR 2011I

The French seem to know Condorcet’s work well!

I

Indeed, 4 out the 9 IACR BoD elected directors areFrench!

Example election: IACR 2011I

The French seem to know Condorcet’s work well!

I

Indeed, 4 out the 9 IACR BoD elected directors areFrench!

I

For these concerned about this, we expect to have avote copying server live before the 2011 IACR elections.

Future work
Can we replace Alice by a “distributed voter”?
In other words:
Essentially a group of respected members
could hold their own primary election, andthen allow others to copy the result. Thisgives an instant voting bloc!